up vote 3 down vote favorite
1
share [g+] share [fb]

I'm having trouble getting a number of scripts running because PHP-FPM can't write to my session folder:

"2009/10/01 23:54:07 [error] 17830#0: *24 FastCGI sent in stderr: "PHP Warning:
    Unknown: open(/var/lib/php/session/sess_cskfq4godj4ka2a637i5lq41o5, O_RDWR)
    failed: Permission denied (13) in Unknown on line 0
PHP Warning:  Unknown: Failed to write session data (files). Please verify
    that the current setting of session.save_path is correct
    (/var/lib/php/session) in Unknown on line 0" while reading upstream"

Obviously this is a permission issue; my session folder's owner/group is the webserver's user, NGINX. PHP-FPM runs as nobody though, and hence adding it to the nginx group is not so trivial.

A temporary solution is to set the permissions of /var/lib/php/session to 777 - I have a feeling that's not the "best practice" though.

What is the best practice when you need to assign a daemon write access to a folder, but it is running as nobody ?

link|improve this question
57% accept rate
feedback

5 Answers

up vote 6 down vote
+100

The correct permissions for us where

chown -R nobody /var/lib/php/session
chgrp -R nobody /var/lib/php/session

as php-cgi runs as nobody, even though NGinx runs as user nginx

link|improve this answer
feedback
up vote 2 down vote

Use /etc/php.ini session.save_path directive.

A temporary solution is to set the permissions of /var/lib/php/session to 777 - I have a feeling that's not the "best practice" though.

"If you leave this set to a world-readable directory, other users on the server may be able to hijack sessions by getting the list of files in that directory. "

link|improve this answer
Sorry I think I may not have been clear: session.save_path is already set to /var/lib/php/session . The problem is I can't figure out what permissions and ownership to assign to the session path directory in order to both enable PHP-FPM to write to it, as well as keep it safe. Having the directory set as owner/group "nginx"(The web server I'm running) and permissions 755 doesn't seem to do the trick – Professor Frink Oct 2 '09 at 12:17
1  
1. Use same user:group for nginx and php-fpm (via either nginx.conf or php-fpm.conf), so you can keep this directory 700. 2. Use chown -R nginx:nobody /var/lib/php/session && chmod -R 770 /var/lib/php/session so i think both nginx and php-fpm can use it – SaveTheRbtz Oct 2 '09 at 14:32
1  
I can confirm that using nginx:nobody (or nginx:nogroup in some circumstances) works. If it is possible, I'd lean towards SaveTheRbtz' option 1, though. – Michael Johnson Oct 22 '09 at 3:24
feedback
up vote 0 down vote

Why not just change the user php-fpm runs as to nginx or something?

http://www.duchnik.com/tutorials/setting-up-php-with-nginx/

link|improve this answer
feedback
up vote 0 down vote

I had the same problem and I solved it. I went to /tmp (that's where my ses_* files are) and deleted them all. After that everything was OK.

IMHO the system was trying to write on old locked files.

The problem occured after I was playing with php.ini. I lost a couple years from my life but eventually I found the solution.

Christos

link|improve this answer
feedback
up vote 0 down vote

I think just change owner of directory

chown root:nginx /var/lib/php/ -R

then no any error again.

myee

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.